F.T.C. sues over tracking data that could expose visits to abortion clinics.
Smartphone location tracking, a multibillion-dollar business in the United States, can reveal intimate details about Americans’ daily routines — including where they go for medical treatments, religious services or mental health counseling.
Now the Federal Trade Commission is suing Kochava, a major location data broker, saying the company’s sale of geolocation information on tens of millions of smartphones could expose people’s private visits to places like abortion clinics and domestic violence shelters.
Such precise data “may be used to track consumers to sensitive locations, including places of religious worship, places that may be used to infer an L.G.B.T.Q.+ identification, domestic abuse shelters, medical facilities, and welfare and homeless shelters,” the F.T.C. said in a complaint filed on Monday.
The location details, the agency said, could be used to identify the mobile phones that people took with them on visits to an abortion clinic as well as the dates and times the visits took place. The data might also be used to trace the locations of health care professionals who provide abortions, the agency said.
Regulators warned that consumers are not aware that their location information is being sold, even though the practice could expose them to serious risks.
“The sale of such data poses an unwarranted intrusion into the most private areas of consumers’ lives and causes or is likely to cause substantial injury to consumers,” the F.T.C. complaint said.
The lawsuit comes at a moment of heightened concern over the privacy and security of reproductive health data. Civil rights groups have warned women seeking abortions in states that have restricted the practice that law enforcement agencies could obtain their smartphone locations and use the data to prosecute them.
Last month, President Biden issued an executive order promising to bolster privacy protections for sensitive health data, including “combating digital surveillance related to reproductive health care services.” The order also urged the F.T.C. to address deceptive uses of reproductive health information.
Based in Sandpoint, Idaho, Kochava is a digital marketing and analytics firm whose software enables app developers to track marketing campaigns. According to the F.T.C. complaint, the company is also a location data broker “that provides its customers massive amounts of precise geolocation data collected from consumers’ mobile devices.”
To illustrate the potential risks to consumers, federal regulators described how easy it was to obtain a free location data set for potential customers that Kochava offered on AWS Marketplace. The sample set contained details related to more than 61 million mobile devices, the agency said.
But the complaint said Kochava had not employed controls to prevent entities from using the free data sample to identify individual consumers or track them to sensitive locations.
In fact, the agency said, the data set made it possible to identify a mobile device that had visited a reproductive health center and trace that device to a single-family home. The sample data also made it possible to track mobile devices to Christian, Islamic and Jewish houses of worship, the complaint said.
In a pre-emptive lawsuit against the F.T.C. filed earlier this month, Kochava denied that its location data could be used to identify people and track them to sensitive places. It also rejected the F.T.C.’s contention that the company did not employ controls to prevent its clients from tracking consumers to sensitive places.
In a statement, Kochava said it compiled with all laws. The location details that the company sells, the statement said, come from third-party information brokers who say consumers consented to the data collection. Kochava also said the F.T.C. complaint suggested that federal regulators had not understood the company’s data business.
“We hoped to have productive conversations that led to effective solutions with the F.T.C. about these complicated and important issues,” Brian Cox, general manager of Kochava’s data marketplace, said in the statement. “Real progress to improve data privacy for consumers will not be reached through flamboyant press releases and frivolous litigation.”
